8 ms·

X.org Security Advisory: Security issue in the X server

43 points by HieronymusBosch 4y ago

charcircuit 4y ago
Are there even any distros who still run Xorg as root?
- paulv 4y ago
  My ubuntu 22.04 LTS (jammy) is running Xorg as root. I have just dist-upgraded since I installed 18.04, so maybe fresh installs don't?
  - notorandit 4y ago
    Maybe.
  - deleted 4y ago
    [deleted]
- notorandit 4y ago
  Wayland is far from mature, even with xorg-xwayland. I personally use it with (fairly uptodate) KDE/Plasma on a Intel Iris Xe Graphics, and still get some annoyances.
  - dTal 4y ago
    I think the comment you're replying to was emphasizing "as root". I can't remember the last time I saw that.
  - dijit 4y ago
    1) I’ve been daily driving Wayland for six years and the only pain I have is that IntelliJ is blurry at 4K 2) Nothing in the parent comment even mentioned Wayland, unless it has been edited- they're saying that people don’t run X.org as root these days (which I am not certain of, since I haven't been running it for so long)
  - alex_duf 4y ago
    I've been using wayland only forever, I'm not sure what you're missing?
    - irthomasthomas 4y ago
      For example: Inter-application communication to allow time-tracking apps, automation, accessibility, and a thousand other use cases. (I can't live without barrier and x over ssh) Wayland is designed to block this feature. Which means it will always remain a niche, only useful for those running multiple monitors with different refresh rates. And even those people are limited to AMD GPUs. So that's a very small niche of a very small niche.
      - nubinetwork 4y ago
        X over ssh can still work on wayland, there is an app called waypipe that does the same thing.
        irthomasthomas 4y ago
        And KDE just built a screen recorder for Wayland. But why bother rewriting all of these tools, when perfectly good, battle-tested solutions already exist in X? Many software makers are unwilling to rewrite their apps from the ground up just to work on a niche system.
        nubinetwork 4y ago
        I think the idea is that they want to get rid of X eventually, if or when that happens is anyone's guess.
        irthomasthomas 4y ago
        Yes, they have made that quite clear. I think it is a real shame that so much time has to be given fixing bugs and recreating software that already exists, rather than developing interesting new software on a stable platform.
  - happymellon 4y ago
    Wayland works great, it's just KDEs implementation that leave something to be desired. If you try other desktops that use Wayland such as Gnome or Sway you will find far fewer issues.
- quotemstr 4y ago
  Does it matter? A user account compromise is as good as a root compromise in many desktop configurations given how often people type "sudo" and how much user data is available as, well, user.
  - charcircuit 4y ago
    >Does it matter? Yes, because this vulnerability requires a user compromise to pull off. I agree that it's already game over once someone has access to your user account.
- basemi 4y ago
  AFAICT ubuntu 22.04 and void uptodate run Xorg as root by default Same for sddm/lxdm
quotemstr 4y ago
Memory unsafe language strikes again. How much longer are we going to put up with this?
- mort96 4y ago
  Forever. Computers are fundamentally unsafe if you tell them to do something you shouldn't have. That's true for every language which has ever been useful.
  - flangola7 4y ago
    Formal verification is a thing. Good architectures make undesirable action rare. What's the last time you heard about a worm that spreads from one Android phone to the next, without the owners realizing it?
    - mavhc 4y ago
      Given that the majority of android phones have dozens of well known security flaws (because they don't get updates, or get them very late), it's kinda weird they're not all one massive botnet. Why is that?
      - flangola7 4y ago
        Mostly because the underlying design makes that difficult. On a traditional desktop an application running as root can do anything, and one running as user can do slightly less than everything. On Android running as root doesn't even exist as a function, and running as user comes with significant limitations enforced structurally by low level SELinux code in the kernel and OS. Android malware can't infect an existing application because the OS both segregates their storage and verifies code signatures. TPMs take this a step further and create not only logical but physical separation between the main CPU and many cryptographic functions. Exploits still happen but you need a much longer chain of vulnerabilities to pull it off.
    - mort96 4y ago
blacklight 4y ago
We're in 2023, and I'm still reading about pieces of software that can be exploited because of poor memory management (either unexpected reads, unexpected writes, or incorrect deallocation). When I started diving into memory issues two decades ago, the younger version of me really thought that, 20 years down the line, we would have figured out better ways to deal with memory other than those buggy malloc, free, sprintf and strcat. Guess what? We have! But way too much C/C++ code is still around. The X window system is 40 years old, some parts of its code literally stand on toothpicks and there's no one left around who still understands them, security flaws keep popping up once every 1-2 months, but it still powers nearly the entirity of the all the UIs that run on a UNIX - based system. Isn't that just insane?
- quotemstr 4y ago
  Too many people think they can write memory safe code when they can't, and they can't because they're human beings, and humans cannot write correct C. Then, when you point out that programs written in some languages are immune to entire classes of vulnerability, these people write things like this: > Memory safeness is just an illusion We're not going to make any progress as an industry until we stop indulging people who think C is cool.
  - blacklight 4y ago
    I'm not saying that it's impossible to break things in Rust/Go/Dart. Im saying that it's several orders of magnitude more difficult. Bugs like these show that, no matter your level of experience in C/C++, you ALWAYS have a high chance of messing things up on memory access, because there are so many things you have to keep in mind while writing your code - and often these bugs are also very difficult to spot. We need to favour languages that don't make things perfect (there's no such thing), but that at least make it much harder for things to break. Like Stroustrup said, we need guns that make it harder to shoot your own leg.
    - pjmlp 4y ago
      Hence why the industry needs a little legal help push, just like when dealing with hazardous chemicals and sharp cutting tools. Thankfully it is starting to take place.
camel-cdr 4y ago
For anybody wondering what caused the bug. They forgot to set a pointer to null after free. Which caused the use after free, because their null checks didn't work.

charcircuit 4y ago

Are there even any distros who still run Xorg as root?

paulv 4y ago
My ubuntu 22.04 LTS (jammy) is running Xorg as root. I have just dist-upgraded since I installed 18.04, so maybe fresh installs don't?
- notorandit 4y ago
  Maybe.
- deleted 4y ago
  [deleted]
notorandit 4y ago
Wayland is far from mature, even with xorg-xwayland. I personally use it with (fairly uptodate) KDE/Plasma on a Intel Iris Xe Graphics, and still get some annoyances.
- dTal 4y ago
  I think the comment you're replying to was emphasizing "as root". I can't remember the last time I saw that.
- dijit 4y ago
  1) I’ve been daily driving Wayland for six years and the only pain I have is that IntelliJ is blurry at 4K 2) Nothing in the parent comment even mentioned Wayland, unless it has been edited- they're saying that people don’t run X.org as root these days (which I am not certain of, since I haven't been running it for so long)
- alex_duf 4y ago
  I've been using wayland only forever, I'm not sure what you're missing?
  - irthomasthomas 4y ago
    For example: Inter-application communication to allow time-tracking apps, automation, accessibility, and a thousand other use cases. (I can't live without barrier and x over ssh) Wayland is designed to block this feature. Which means it will always remain a niche, only useful for those running multiple monitors with different refresh rates. And even those people are limited to AMD GPUs. So that's a very small niche of a very small niche.
    - nubinetwork 4y ago
      X over ssh can still work on wayland, there is an app called waypipe that does the same thing.
      - irthomasthomas 4y ago
        And KDE just built a screen recorder for Wayland. But why bother rewriting all of these tools, when perfectly good, battle-tested solutions already exist in X? Many software makers are unwilling to rewrite their apps from the ground up just to work on a niche system.
        nubinetwork 4y ago
        I think the idea is that they want to get rid of X eventually, if or when that happens is anyone's guess.
        irthomasthomas 4y ago
        Yes, they have made that quite clear. I think it is a real shame that so much time has to be given fixing bugs and recreating software that already exists, rather than developing interesting new software on a stable platform.
- happymellon 4y ago
  Wayland works great, it's just KDEs implementation that leave something to be desired. If you try other desktops that use Wayland such as Gnome or Sway you will find far fewer issues.
quotemstr 4y ago
Does it matter? A user account compromise is as good as a root compromise in many desktop configurations given how often people type "sudo" and how much user data is available as, well, user.
- charcircuit 4y ago
  >Does it matter? Yes, because this vulnerability requires a user compromise to pull off. I agree that it's already game over once someone has access to your user account.
basemi 4y ago
AFAICT ubuntu 22.04 and void uptodate run Xorg as root by default Same for sddm/lxdm

quotemstr 4y ago

Memory unsafe language strikes again. How much longer are we going to put up with this?

mort96 4y ago
Forever. Computers are fundamentally unsafe if you tell them to do something you shouldn't have. That's true for every language which has ever been useful.
- flangola7 4y ago
  Formal verification is a thing. Good architectures make undesirable action rare. What's the last time you heard about a worm that spreads from one Android phone to the next, without the owners realizing it?
  - mavhc 4y ago
    Given that the majority of android phones have dozens of well known security flaws (because they don't get updates, or get them very late), it's kinda weird they're not all one massive botnet. Why is that?
    - flangola7 4y ago
      Mostly because the underlying design makes that difficult. On a traditional desktop an application running as root can do anything, and one running as user can do slightly less than everything. On Android running as root doesn't even exist as a function, and running as user comes with significant limitations enforced structurally by low level SELinux code in the kernel and OS. Android malware can't infect an existing application because the OS both segregates their storage and verifies code signatures. TPMs take this a step further and create not only logical but physical separation between the main CPU and many cryptographic functions. Exploits still happen but you need a much longer chain of vulnerabilities to pull it off.
  - mort96 4y ago

blacklight 4y ago

We're in 2023, and I'm still reading about pieces of software that can be exploited because of poor memory management (either unexpected reads, unexpected writes, or incorrect deallocation). When I started diving into memory issues two decades ago, the younger version of me really thought that, 20 years down the line, we would have figured out better ways to deal with memory other than those buggy malloc, free, sprintf and strcat. Guess what? We have! But way too much C/C++ code is still around. The X window system is 40 years old, some parts of its code literally stand on toothpicks and there's no one left around who still understands them, security flaws keep popping up once every 1-2 months, but it still powers nearly the entirity of the all the UIs that run on a UNIX - based system. Isn't that just insane?

quotemstr 4y ago
Too many people think they can write memory safe code when they can't, and they can't because they're human beings, and humans cannot write correct C. Then, when you point out that programs written in some languages are immune to entire classes of vulnerability, these people write things like this: > Memory safeness is just an illusion We're not going to make any progress as an industry until we stop indulging people who think C is cool.
- blacklight 4y ago
  I'm not saying that it's impossible to break things in Rust/Go/Dart. Im saying that it's several orders of magnitude more difficult. Bugs like these show that, no matter your level of experience in C/C++, you ALWAYS have a high chance of messing things up on memory access, because there are so many things you have to keep in mind while writing your code - and often these bugs are also very difficult to spot. We need to favour languages that don't make things perfect (there's no such thing), but that at least make it much harder for things to break. Like Stroustrup said, we need guns that make it harder to shoot your own leg.
  - pjmlp 4y ago
    Hence why the industry needs a little legal help push, just like when dealing with hazardous chemicals and sharp cutting tools. Thankfully it is starting to take place.

camel-cdr 4y ago

For anybody wondering what caused the bug. They forgot to set a pointer to null after free. Which caused the use after free, because their null checks didn't work.